Junglewise Threat Intelligence

CVE-2025-13462: Python CPython tarfile misinterpretation via GNU long name normalization

CVE-2025-13462 · Severity: info · CVSS 2 · Published 2026-03-12

Technologies: Python Software Foundation CPython. Vendors: Python Software Foundation.

Executive brief

A vulnerability in Python's standard library for handling compressed archives could allow a specially crafted file to be misinterpreted. This issue occurs when processing files with very long names, causing the library to incorrectly identify a regular file as a directory. This can lead to data corruption during file extraction or cause software to stop reading the archive prematurely, potentially impacting the reliability of automated deployment tools and package managers.

Technical details

The 'tarfile' module in CPython contains a logic error in its header parsing routine. When processing multi-block members such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK, the module incorrectly applies normalization of AREGTYPE (\x00) blocks to DIRTYPE based on 'garbage' data in the secondary header. This root cause is located in the frombuf() function, which overrides the entry type to a directory. Consequently, the file offset is not updated correctly, often causing the parser to silently discard subsequent entries or fail with an exception. This can be exploited via a crafted tar archive to cause a denial of service (incomplete extraction) or bypass security checks that rely on accurate file type identification. Patches have been merged into CPython branches 3.10 through 3.14.

Affected products

  • Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14

Timeline

  • 2025-11-18: disclosed: Issue first reported on GitHub
  • 2026-03-12: advisory: CVE published and NVD record created

References

Related threats